Epherem
Claim this toolScan AI-built apps for security flaws and get fix prompts for your coding tool
Free, no paid tier Visit Website Free Visit Website
Tracked since 2026
The Bottom Line
- Price
- Free, no paid tier. Compare plans
Key facts
- Scans AI-built apps for 55 types of security mistakes, including exposed keys, open databases, missing authentication, and unsafe input.
- Provides plain-language explanations and fix prompts you can paste directly into AI coding tools like Cursor or Lovable.
- Free with up to 5 scans per day; honest about what it cannot check and never claims a scan is complete.
Pros
- Free to use with no hidden costs
- Explains security issues in plain language, accessible to non-experts
- Provides actionable fix prompts that integrate directly with AI coding tools
Cons
- Limited to static analysis; does not test your live site or run the application
- Only fully supports JavaScript and TypeScript; Python coverage is partial and other languages are not analyzed
- Cannot check settings configured in external dashboards (e.g., Supabase) or confirm findings that require runtime context
What is Epherem?
Epherem is a free security scanner designed specifically for applications built with AI coding tools like Lovable, Bolt, Cursor, and similar platforms. It performs static analysis on your project's code, configuration files, and dependencies to identify common security mistakes that AI-generated code often leaves behind. With 55 targeted checks, it looks for exposed keys, open database tables, missing authentication and authorization checks, unsafe input handling, and SQL injection vulnerabilities. It also cross-references your exact package versions against published advisories from the OSV database.
Epherem is built for the person who created the app, not a security expert. Every finding is explained in plain language: what's wrong, what an attacker could do with it, and how to fix it. Each issue includes a ready-to-use prompt that you can paste into your AI tool (such as Cursor, Lovable, or Claude Code) to automatically generate the code change. The scanner is honest about its limitations: it never runs your app, it doesn't see settings in external dashboards, and it clearly marks findings that need human verification. Coverage is strongest for JavaScript and TypeScript, with partial support for Python. After each scan, your code is deleted, and only your report remains in your account until you delete it.
Key Features
- 55 static analysis checks targeting mistakes common in AI-generated code
- Package vulnerability scanning against the OSV advisory database (with exact version matching from lockfiles)
- Findings grouped into three categories: known issues (published advisories), likely issues (risky code detected), and needs checking (ambiguous or missing protections)
- Fix prompts for AI tools like Cursor, Lovable, and Claude Code included with each finding
- Support for JavaScript, TypeScript, and partial Python; other languages are not analyzed
- Upload your project as a ZIP or connect a GitHub repository
- Reports name every file that could not be analyzed, so a quiet report is never falsely clean
Pricing Plans
| Plan | Price | Details |
|---|---|---|
| Free | Free |
|
Is Epherem worth the price?
Great value
Epherem's Free tier is extremely generous for an early access security scanning tool, offering 5 scans per day with no time limit on the free period, making it an excellent entry point for individual developers or small teams.
At $0 per month, it is significantly cheaper than most competitors who either charge per scan or require a subscription for similar features. This pricing is best for early adopters who want to test the AI-powered vulnerability detection before committing to a paid plan.
Reviews
$99 Free with your review
Write a review Review Epherem, get a free AI guide
Share your experience and we will send you Improve Your Thinking Patterns Using ChatGPT, free.
Best Epherem Alternatives
Top alternatives based on features, pricing, and user needs.
Aikido Security Paid
Secure your code, cloud, and runtime in one central system, finding and fixing vulnerabilities automatically.
Snyk Freemium
Secure your code, dependencies, containers, and IaC from dev to production
Corgea Freemium
AI-powered appsec that finds real risk and fixes flaws
qsa.sh Freemium
External port and vulnerability scans from your terminal
GitHub Advanced Security Paid
Secure your code with AI-assisted scanning and secret protection
Hacktron Freemium
Your AI teammate for security, identifying real vulnerabilities and empowering developers.
Cotool Security Freemium
Comprehensive security monitoring and vulnerability scanning for your digital assets.
Still deciding?
Most buyers shortlist 2 or 3 tools before committing. Pull a side-by-side comparison or browse the full alternatives shortlist below.
Explore More
Epherem FAQ
What types of security issues does Epherem scan for?
Epherem runs 55 checks that look for exposed keys and secrets, open database tables, missing login and ownership checks, unsafe input handling, SQL injection, missing CSRF protection, and vulnerable package versions. The checks are specifically designed for mistakes that AI coding tools tend to introduce.
How does Epherem handle my code and privacy?
Your uploaded code is used only to run the scan and is deleted immediately afterward. Your report stays in your account until you delete it. Code is never sent to any AI provider; only package names and versions are sent to OSV.dev to look up advisories.
Can Epherem automatically fix the issues it finds?
Epherem provides a fix prompt for each finding that you can copy and paste into an AI tool like Cursor, Lovable, or Claude Code. The AI tool can then generate the code change. However, some fixes, such as rotating a leaked key, must be done manually in the relevant dashboard (e.g., Supabase).
Does Epherem support all programming languages?
Coverage is strong for JavaScript and TypeScript and partial for Python. Other languages are not analyzed, and any such files are named in the report as 'not analyzed' rather than reported as clean. The scanner is optimized for the languages most commonly used with AI coding tools.
How do I know which findings to prioritize?
Findings are grouped into three categories: 'Known issues' are published advisories matching your package versions; 'Likely issues' are where the scanner saw the risky code itself, start there; 'Needs checking' are where it looked for a protection and didn't see it, or the match depends on context it cannot see. Likely issues should be addressed first.
What does it mean when a finding is marked as 'needs checking'?
It means the scanner looked for a protection (like a login check or CSRF token) and either didn't see it or the context was ambiguous. The issue may still exist somewhere the scan couldn't see, or it might be a false positive. You should manually review these findings and decide if a fix is needed.
How often can I scan my project?
You can run up to 5 scans per day during early access. Each scan is a new report of your code as it is at that moment. After fixing issues, you can scan again to verify the changes.
Can I connect my GitHub repository instead of uploading a ZIP?
Yes, you can either upload a ZIP of your project or connect a GitHub repository and select a repository to scan. The scan reads your code, settings files, and package list without ever running your app.
Source: epherem.com